--- name: verify-the-subject-not-just-the-measurement description: Every check verifies what a run measured; none verifies WHICH TREE it measured — assert ancestry of the candidate before trusting any green metadata: node_type: memory type: feedback originSessionId: f290ac0f-f897-4dce-95ca-1e71f27ae4a8 modified: 2026-07-30T01:54:17.804Z --- **A competent instrument pointed at the wrong artifact passes.** doyle's "Face 6", 2026-07-29, on the v0.46.0 near-miss. **The near-miss:** the release candidate `aa487b9` did NOT contain the six-commit repair batch (`ce4386e`). The two lines were SIBLINGS off `af65ac0`, not a chain — `git merge-base ce4386e aa487b9` → `af65ac0`. Pushing it would have run golden CI on a tree missing both the SPT_HOME bystander repair the whole night existed to land AND the twohost independence change that had just produced the first-ever cross-machine seam evidence. **It would very likely have come back GREEN** — the Windows red lived in the other line's test file, so there was nothing left in the tree to fail. We would have shipped a green run as evidence for a repair that was not in the tree, and every check built that night — job-level queries, non-vacuity discriminators, per-box role asymmetry — would have PASSED while attesting to the wrong tree. **Why:** every one of those checks verifies *what a run measured*. Not one verifies *which tree it measured*. Provenance of the SUBJECT, not quality of the instrument. It is [[name-the-file-and-sha-a-condition-came-from]] one level up: the instrument was competent and the subject was wrong. **How to apply — assert ancestry, at the candidate, before trusting any green:** - `git merge-base --is-ancestor ` → must be 0. Ancestry is the missing check; it was absent from ADR-0050 entirely. - **Ancestry alone will not catch a bad cherry-pick.** Pair it with file-level assertions on content you know must be present: a blob hash (`git rev-parse :`), an occurrence count, a required file in `git diff --name-only`. - A rebase preserves a file iff the parent blob is byte-identical on both lines — prove that by blob, don't argue it. Conversely an **amend** that changes the file voids any result obtained against the pre-amend sha, even when a ruling "supersedes the hold": `1ac7a7d`'s blob `4ba6fc07` ≠ `b3a545c`'s `4ee6d7a3`, so a Leg D green against the former tested bytes that do not ship. ⭐⭐ **What caught it was a falsifiable NUMBER, not a narrative.** I went to verify concrete counts written into a hazard seed — "servicehost 1, daemon_inhibit 5, one per public fn" — measured 1 and **3**, and saw the pre-refactor `spt_home().join(...)` still in the tree. The seed was right; the TREE was wrong. **Prose cannot be wrong in a way that trips an assertion.** That is the argument for putting concrete counts and hashes into doctrine text instead of description — it paid twice in four hours on the release critical path. ⚠ **My own error in the same episode, same family one level down:** I told the gater "nothing is missing from the tree and nothing is wrong with the plan" after verifying exactly ONE link of parentage (`1ac7a7d^ = fef38be`) and *inferring* the chain back to `ce4386e`. He reasoned a ruling from that sentence. **Verify every link you assert, or assert only the link you verified.** Owning it in the same message as the catch is what let him keep acting on my reports at speed. ⭐⭐ **THE GAP IS NOW CLOSED BY A MECHANISM — doyle's four post-push assertions, measured FROM THE REMOTE and not from the push's exit code (2026-07-30, main af65ac0 → 8f3e10b, ff-only, 11 commits / 14 files):** 1. exact equality — `git ls-remote refs/heads/main` == the tested sha · 2. API equality — `gh api commits/main .sha` == same · 3. **TREE equality — `gh api commits/main .commit.tree.sha` = `209744ba339f33bd23c6232098b35311524da2b3` == `git rev-parse 8f3e10b^{tree}` captured BEFORE the merge** · 4. ancestry — `merge-base --is-ancestor tested remote`. **#3 is the one that finally answers "which tree did I publish", and it is the assertion this whole entry was demanding.** Sha equality alone passes over a **re-minted commit** (a rebase/amend mints a new sha for identical content, and the converse — same sha, different content — cannot happen, but a chain re-minted under you leaves the sha you push different from the sha you tested while every narrative still reads right). Capturing the expected tree hash BEFORE the mutation and comparing it against the remote AFTER is the falsifiable-number form of this rule, applied to the publish step. Adopt all four; #3 is non-negotiable. Note the inversion from a push's own exit code: **a successful push tells you the transport worked, never which tree now sits at the ref** — same shape as [[verdict-from-exit-not-from-silence]]. Kin: [[verdict-from-probe-competence]], [[measure-what-costs-one-command]], [[intermittent-green-is-zero-information]], [[opt-in-ci-legs-skip-silently]], [[golden-ci-strategy]], [[release-standard-bump-in-pr]].